# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1642341604 -3600
# Node ID a89cf47ba8ed8df648b5ec3c6f9aeb7e39955a86
# Parent  18eff22f94bd61c0ce862a8cb77d5d245502ddca
patch 8.2.4108: going over the end of the w_lines array

Commit: https://github.com/vim/vim/commit/f6ebc820041b3f77794297026b46c1ebbc279a3a
Author: Bram Moolenaar <Bram@vim.org>
Date:   Sun Jan 16 13:58:33 2022 +0000

    patch 8.2.4108: going over the end of the w_lines array

    Problem:    Going over the end of the w_lines array.
    Solution:   Check not going over the end and limit to Rows. (issue https://github.com/vim/vim/issues/9540)

diff --git a/src/drawscreen.c b/src/drawscreen.c
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -1815,10 +1815,11 @@ win_update(win_T *wp)
 	    // When topline didn't change, find first entry in w_lines[] that
 	    // needs updating.
 
-	    // try to find wp->w_topline in wp->w_lines[].wl_lnum
+	    // Try to find wp->w_topline in wp->w_lines[].wl_lnum.  The check
+	    // for "Rows" is in case "wl_size" is incorrect somehow.
 	    j = -1;
 	    row = 0;
-	    for (i = 0; i < wp->w_lines_valid; i++)
+	    for (i = 0; i < wp->w_lines_valid && i < Rows; i++)
 	    {
 		if (wp->w_lines[i].wl_valid
 			&& wp->w_lines[i].wl_lnum == wp->w_topline)
@@ -1848,6 +1849,8 @@ win_update(win_T *wp)
 		// ... but don't delete new filler lines.
 		row -= wp->w_topfill;
 #endif
+		if (row > Rows)  // just in case
+		    row = Rows;
 		if (row > 0)
 		{
 		    check_for_delay(FALSE);
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -751,6 +751,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    4108,
+/**/
     4107,
 /**/
     4106,